Someone Is Asking for the Code I Just Got by Text. Should I Share It?

Short answer: no, never. That code is the last lock on your account, and anyone who asks you for it is trying to get in.

What a verification code is

When you log in or make a payment, many apps and banks send a short code by text or email. You type it in to prove it's really you. This is called two-step verification, and the code is often called a one-time code or OTP.

It works because a criminal needs both your password and that code. Even if they have your password, they can't get in without the code. So the code is exactly what they will try to talk you into giving them.

The stories they tell

1. "This is your bank's fraud team." They say they have stopped a suspicious payment and need you to read out the code to cancel it. Reading it out actually approves what they are doing.
2. "I sent you a code by mistake." A message, sometimes from a friend's hacked account, asks you to forward a code that just arrived. That code is for your account, often your WhatsApp.
3. "I need to check you're real." A buyer answering something you are selling online asks you to read them a code. They are using your phone number to set up an account in your name.

What they can do with your code

With your code, a scammer can log into your account, change your password and email so you are locked out, move your money, or take over your WhatsApp and message your friends and family pretending to be you. Some use your number to open new accounts that hide who they are.

What to do when someone asks

1. Don't read it out, type it, or forward it, no matter who they say they are.
2. Hang up or stop replying, and block the number.
3. If you're worried about your account, contact the company yourself using its official app or the number on your card or statement.

If you already shared a code

1. Contact the company straight away using its official app or number, and tell them what happened so they can secure the account.
2. Change your password, and check the account for new logins, payments, or changed details.
3. If it was your WhatsApp, reopen WhatsApp and verify your phone number again to log back in, then turn on two-step verification in Settings, Account, Two-step verification, so a code alone can't take it again. Warn your contacts not to answer messages sent from your account.
4. Report it at ReportFraud.ftc.gov in the US, or to your country's fraud reporting service.

The rule is simple enough to teach anyone: codes are for typing in, never for telling someone.

Sources: FTC: What's a verification code and why would someone ask me for it? · FTC: The Google Voice scam